Messages in this thread | | | Date | Mon, 8 Aug 2022 12:31:37 -0700 | From | Nathan Chancellor <> | Subject | Re: [PATCH] x86: assemble with -Wa,--noexecstack to avoid BFD 2.39 warning |
| |
On Mon, Aug 08, 2022 at 12:23:05PM -0700, Nick Desaulniers wrote: > Users of GNU ld (BFD) from binutils 2.39+ will observe multiple instance > of a new warning when linking kernels in the form: > > ld: warning: arch/x86/realmode/rm/bioscall.o: missing .note.GNU-stack > section implies executable stack > ld: NOTE: This behaviour is deprecated and will be removed in a future > version of the linker > > The object files producing these all happen to be out of line assembler > sources (*.S files). > > Generally, we would like to avoid the stack being executable. Because > there could be a need for the stack to be executable, assembler sources > have to opt-in to this security feature via explicit creation of the > .note.GNU-stack feature (which compilers create by default) or command > line flag --noexecstack. > > Boot tested defconfig and i386_defconfig in QEMU. If any assembler > sources do require executable stack, they can be built with > -Wa,--execstack, though the linker warning would have to be disabled. We > might need to extend this more generally to the top level Makefile for > all architectures, but I'm not equipped to test the result of such a > change. > > LLVM's LLD linker defaults to -z noexecstack, so this flag isn't > strictly necessary when linking with LLD, only BFD, but it doesn't hurt > to be explicit here for all linkers IMO. > > Link: https://lore.kernel.org/linux-block/3af4127a-f453-4cf7-f133-a181cce06f73@kernel.dk/ > Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ba951afb99912da01a6e8434126b8fac7aa75107 > Link: https://github.com/llvm/llvm-project/issues/57009 > Reported-by: Jens Axboe <axboe@kernel.dk> > Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
FWIW, this warning appears for other architectures, as I have seen it with powerpc and s390 and there is also a patch for ARM:
https://lore.kernel.org/20220721204709.445216-1-ben-linux@fluff.org/
Perhaps this should be done for all architectures in the main Makefile?
> --- > arch/x86/Makefile | 2 ++ > arch/x86/boot/Makefile | 2 +- > arch/x86/boot/compressed/Makefile | 2 +- > arch/x86/realmode/rm/Makefile | 2 +- > 4 files changed, 5 insertions(+), 3 deletions(-) > > diff --git a/arch/x86/Makefile b/arch/x86/Makefile > index 7854685c5f25..571546775725 100644 > --- a/arch/x86/Makefile > +++ b/arch/x86/Makefile > @@ -159,6 +159,8 @@ else > KBUILD_CFLAGS += -mcmodel=kernel > endif > > +KBUILD_AFLAGS += -Wa,--noexecstack > + > # > # If the function graph tracer is used with mcount instead of fentry, > # '-maccumulate-outgoing-args' is needed to prevent a GCC bug > diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile > index b5aecb524a8a..d7f2130f2277 100644 > --- a/arch/x86/boot/Makefile > +++ b/arch/x86/boot/Makefile > @@ -67,7 +67,7 @@ targets += cpustr.h > # --------------------------------------------------------------------------- > > KBUILD_CFLAGS := $(REALMODE_CFLAGS) -D_SETUP > -KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__ > +KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__ -Wa,--noexecstack > KBUILD_CFLAGS += $(call cc-option,-fmacro-prefix-map=$(srctree)/=) > KBUILD_CFLAGS += -fno-asynchronous-unwind-tables > GCOV_PROFILE := n > diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile > index 19e1905dcbf6..1587a21a132d 100644 > --- a/arch/x86/boot/compressed/Makefile > +++ b/arch/x86/boot/compressed/Makefile > @@ -57,7 +57,7 @@ KBUILD_CFLAGS += -include $(srctree)/include/linux/hidden.h > # that the compiler finds it even with out-of-tree builds (make O=/some/path). > CFLAGS_sev.o += -I$(objtree)/arch/x86/lib/ > > -KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__ > +KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__ -Wa,--noexecstack > GCOV_PROFILE := n > UBSAN_SANITIZE :=n > > diff --git a/arch/x86/realmode/rm/Makefile b/arch/x86/realmode/rm/Makefile > index 83f1b6a56449..5f2fdafaa034 100644 > --- a/arch/x86/realmode/rm/Makefile > +++ b/arch/x86/realmode/rm/Makefile > @@ -73,7 +73,7 @@ $(obj)/realmode.relocs: $(obj)/realmode.elf FORCE > > KBUILD_CFLAGS := $(REALMODE_CFLAGS) -D_SETUP -D_WAKEUP \ > -I$(srctree)/arch/x86/boot > -KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__ > +KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__ -Wa,--noexecstack > KBUILD_CFLAGS += -fno-asynchronous-unwind-tables > GCOV_PROFILE := n > UBSAN_SANITIZE := n > -- > 2.37.1.559.g78731f0fdb-goog >
| |